---
typeId: req
recordId: benac-cap-007
fields:
  title: Capability identifiers
  statement: >-
    Benac shall define stable capability identifiers used by packages, approvals,
    capability grants, invocations, evidence records, effect records, diagnostics, and
    Station Profiles.

    A capability identifier shall be a stable string.

    A known capability identifier shall not grant authority.

    An unknown capability identifier shall not grant authority.

    A package shall declare every capability it requires for each operation phase.

    A capability grant shall be a separate Local Policy decision.

    A Host Implementation shall not perform a package operation unless Local Policy
    grants every capability required for that operation.

    A Host Implementation shall not treat any declared capability as default, implied,
    ambient, or automatically granted.

    A Host Implementation shall not treat aliases, legacy synonyms, host-local
    convenience names, package labels, provider names, model names, file names, URLs, or
    human-readable descriptions as capability identifiers.

    Unknown capability identifiers required for package import or package validation
    shall fail the required operation.

    Unknown capability identifiers required for package approval, fixture execution,
    package invocation, package-requested effects, retrieval, storage, or compute shall
    block that operation and shall be recorded in inspection, approval, invocation,
    effect, retrieval, storage, compute, or diagnostic records.

    No capability identifier shall be categorically granted because of a package class.

    No capability identifier shall be categorically denied because of a package class.
  rationale: >-
    Independent implementations need stable capability identifiers, but capability
    declarations must not become authority. Local Policy decides which requested
    capabilities are granted.
  verification: >-
    Tests verify that declared capabilities do not grant authority. Tests verify that
    invocation is blocked until every required capability for invocation is granted.
    Tests verify that known and unknown capability identifiers are inspected and handled
    by operation phase without package-class treatment.
  testable: true
  status: draft
  area: BENAC-CAP
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Trust, policy, and capability model
  order: 87.08
---
